FSSO Local vs "Collector and Agent"

[nbctcp]

SW INFO: -Fortigate VM Eval 6.2.3

I just tried both method of FSSO which is Local and  "Collector and Agent".

Since both can do

-point to multiple AD

-filter to certain groups only

QUESTIONS: 1. what  "Collector and Agent" can do which Local FSSO can't do

2. in what situation Local is enough because Local doesn't have to install any software

tq

[Alivo__FTNT · Accepted solution]

Hello,

What Collector Agent can do ie. is:

polls: 672, 673, 680, 4768, 4769, 4776, 4624 Event IDs unlike polling from FortiGate limited to 4768, 4769.

IP ignore list Workstation check

RDP logon override

Extensive logging capability for troubleshooting

Scalability - can suit very large environments with DCs around the globe

Various methods of getting logon information

+ Collector Agent does not use FortiGate's hw resources

to name few advantages over polling directly from FortiGate.

Local might be good enough for a smaller office with modest AD environment.

Best Regards,

Alivo

[Alivo__FTNT · Accepted solution]

Hello,

What Collector Agent can do ie. is:

polls: 672, 673, 680, 4768, 4769, 4776, 4624 Event IDs unlike polling from FortiGate limited to 4768, 4769.

IP ignore list Workstation check

RDP logon override

Extensive logging capability for troubleshooting

Scalability - can suit very large environments with DCs around the globe

Various methods of getting logon information

+ Collector Agent does not use FortiGate's hw resources

to name few advantages over polling directly from FortiGate.

Local might be good enough for a smaller office with modest AD environment.

Best Regards,

Alivo

[xsilver_FTNT · Accepted solution]

https://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD38897